I am implementing security on a WCF service from basicHttp to WShttp, the issue is the service sends some passwords for connections to the database that the user can define,test and save.

The service implements a X509 certificate for the service and client credentials and wanted to know if I should do more to secure the Passwords on the server or the client?

    <binding name="CustomLargeHttpsBinding" maxReceivedMessageSize="2147483647">
      <readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647"/>
      <reliableSession ordered="false" inactivityTimeout="01:00:00" enabled="false"/>
        <transport clientCredentialType="None" proxyCredentialType="None"/>
        <message clientCredentialType="Certificate" negotiateServiceCredential="true" algorithmSuite="Basic256Rsa15" establishSecurityContext="true"/>

The typical scenario would go like this :

  • Retrieve encrypted password from database
  • Send data through the service
  • Client uses data to test database connection on server X(Password is put into a secure string here after being decrypted
  • Issue being that I would like to remove the encrypting class as it has a constant key stored in code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.